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1 Claim 1 (original) : A method for generating traffic 

2 information for analysis, the method comprising: 

3 a) accepting at least one sample derived from 

4 addressed data; 

5 b) determining path-centric information based on the 

6 accepted at least one sample; and 

7 c) adjusting a traffic metric of a traffic parameter 

8 based on the determined path-centric information. 

1 Claim 2 (original) : The method of claim 1 wherein the 

2 addressed data is a packet. 

1 Claim 3 (original) : The method of claim 1 wherein the 

2 sample includes information from the header of a packet. 

1 Claim 4 (original) : The method of claim 1 wherein the act 

2 of determining path-centric information based on the 

3 accepted at least one sample includes using at least a part 

4 of the at least one sample as a search key to find an item 

5 with a closest matching key in a data structure. 

1 Claim 5 (original) : The method of claim 4 wherein the data 

2 structure is a searchable data structure selected from a 

3 group consisting of (A) a hash table, (B) a binary search 

4 tree, and (C) a trie. 
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1 Claim 6 (original) : The method of claim 1 wherein the act 

2 of determining path-centric information based on the 

3 accepted at least one sample includes: 

4 i) using at least a part of the at least one 

5 sample as a search key to find a first item with 

6 a closest matching key in a first data structure; 

7 and 

8 ii) using at least a part of the first item 

9 found as a search key to find a second item with 
10 a matching key in a second data structure. 

1 Claim 7 (original) : The method of claim 6 wherein the 

2 second item includes path-centric information. 

1 Claim 8 (original) : The method of claim 6 wherein the 

2 second item includes an origin autonomous system and a peer 

3 autonomous system. 



1 Claim 9 (original) : The method of claim 6 wherein the 

2 second item includes an autonomous system path. 

1 Claim 10 (original) : The method of claim 6 wherein the 

2 first and second data structures are tries. 

1 Claim 11 (original) : The method of claim 6 wherein the 

2 first data structure is a Radix trie. 

1 Claim 12 (original) : The method of claim 6 wherein the at 

2 least a part of the at least one sample used as a search 

3 key is an internet protocol prefix. 
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1 Claim 13 (original) : The method of claim 6 wherein the at 

2 least a part of the at least one sample used as a search 

3 key is at least one of (A) a source address and (B) a 

4 destination address. 

1 Claim 14 (original) : The method of claim 6 wherein the at 

2 least a part of the first item found used as a search key 

3 is an autonomous system index. 

1 Claim 15 (original) : The method of claim 1 wherein the 

2 sample includes at least two parameters selected from a 

3 group parameters consisting of (A) a source address, (B) a 

4 destination address, (C) a protocol, (D) a source port, (E) 

5 a destination port, (F) an interface number, (G) a type of 

6 service, (H) an SNMP index, (I) a kernel logical interface 

7 index, and (J) a type of interface indice. 

1 Claim 16 (original) : The method of claim 1 wherein the 

2 path-centric information determined includes an origin 

3 autonomous system and a peer autonomous system. 

1 Claim 17 (original) : The method of claim 1 wherein the 

2 path-centric information determined includes an autonomous 

3 system path. 

1 Claim 18 (original) : The method of claim 1 wherein the act 

2 of adjusting a traffic metric of a traffic parameter based 

3 on the determined path-centric information includes: 

4 i) using a part of the determined path-centric 

5 information as a key to search items of traffic 

6 parameters; 
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ii) if a traffic parameter with a matching key 
is found, incrementing its traffic metric; 
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iii) if none of the traffic parameters has a 
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matching key, creating a new item. 



1 Claim 19 (original) : The method of claim 1 wherein the 

2 traffic metric adjusted is at least one of (A) a byte count 

3 and (B) a packet count. 

1 Claim 2 0 (original) : The method of claim 1 wherein the 

2 traffic parameter is selected from a group of traffic 

3. parameters consisting of (A) a particular pair of source 

4 and destination addresses, (B) a particular pair of source 

5 and destination ports, and (C) a particular pair of 

6 autonomous systems. 

1 Claim 21 (currently amended) : A method for generating data 

2 structures for mapping information in a sample derived from 

3 addressed data, to path-centric information, the method 

4 comprising: 

5 a) using network information, building a first data 

6 structure including items of a first type, each of the 

7 items of the first type including an autonomous system 

8 index and an internet protocol prefix, wherein the 

9 internet protocol prefix is a key; and 

10 b) using network information, building a second data 

11 structure including items of a second type, each of 

12 the items of the second type including an autonomous 

13 system index and an autonomous system path, wherein 

14 the autonomous system index is a key^ 
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15 wherein the first and second data structures 

16 may be used for generating traffic information for 

17 analysis . 

1 Claim 22 (original) : The method of claim 21 wherein the 

2 first and second data structures are tries. 

1 Claim 23 (original) : The method of claim 21 wherein the 

2 first data structure is a Radix trie. 

1 Claim 24 (original) : The method of claim 21 wherein the 

2 network information was derived from routing information. 

1 Claim 25 (original) : An apparatus for generating traffic 

2 information for analysis , the apparatus comprising: 

3 a) an input for accepting at least one sample derived 

4 from addressed data; 

5 b) means for determining path-centric information 

6 based on the accepted at least one sample; and 

7 c) means for adjusting a traffic metric of a traffic 

8 parameter based on the determined path-centric 

9 information . 

1 Claim 26 (original) : The apparatus of claim 25 wherein the 

2 means for determining path-centric information based on the 

3 accepted at least one sample include a searching facility, 

4 the search facility (i) using at least a part of the at 

5 least one sample as a search key to find a first item with 

6 a closest matching key in a first data structure, and (ii) 

7 using at least a part of the first item found as a search 

8 key to find a second item with a matching key in a second 

9 data structure. 
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Claim 27 (original) : The apparatus of claim 2 6 wherein the 
second item includes path-centric information. 



1 Claim 28 (original) : The apparatus of claim 2 6 wherein the 

2 second item includes an origin autonomous system and a peer 

3 autonomous system. 

1 Claim 29 (original) : The apparatus of claim 2 6 wherein the 

2 second item includes an autonomous system path. 

-\ 

1 Claim 30 (original) : The apparatus of claim 2 5 wherein the 

2 means for adjusting a traffic metric of a traffic parameter 

3 based on the determined path-centric information include 

4 i) a search facility, using a part of the 

5 determined path-centric information as a key to 

6 search items of traffic parameters; and 

7 ii) an aggregator, wherein if a traffic 

8 parameter with a matching key is found, the 

9 aggregator increments the traffic metric of the 

10 traffic parameter, and wherein if none of the 

11 traffic parameters has a matching key, the 

12 aggregator creates a new item. 

1 Claim 31 (original) : The apparatus of claim 25 wherein the 

2 traffic parameter is selected from a group of traffic 

3 parameters consisting of (A) a particular pair of source 

4 and destination addresses, (B) a particular pair of source 

5 and destination ports, and (C) a particular pair of 

6 autonomous systems. 

1 Claim 32 (original) : A data forwarding device comprising: 
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2 a) an addressed data forwarding facility for 

3 forwarding addressed data based on forwarding 

4 information; 

5 b) a routing facility for determining and 

6 disseminating network state information, and for 

7 generating path information based on the network state 

8 information; 

9 c) a sampler for generating samples based on accepted 

10 addressed data; 

11 d) means for determining path-centric information 

12 based on the samples generated by the sampler; and 

13 e) means for adjusting a traffic metric of a traffic 

14 parameter based on the determined path-centric 

15 information. 

1 Claim 33 (original) : The data forwarding device of claim 

2 32 wherein the routing facility effects a exterior gateway 

3 protocol . 

1 Claim 34 (original) : The data forwarding device of claim 

2 32 wherein the routing facility effects a border gateway 

3 protocol. 

1 Claim 35 (currently amended) : A data forwarding device 

2 comprising: 

3 a) an addressed data forwarding facility for 

4 forwarding addressed data based on forwarding 

5 information; 

6 b) a routing facility for determining and 

7 disseminating network state information, and for 

8 generating path information based on the network state 

9 information; 
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10 c) means, using the path information generated by the 

11 routing facility, for building a first data structure 

12 including items of a first type, each of the items of 

13 the first type including an autonomous system index 

14 and an internet protocol prefix, wherein the internet 

15 protocol prefix is a key; and 

16 d) means, using the path information generated by the 

17 routing facility, for building a second data structure 

18 including items of a second type, each of the items of 

19 the second type including an autonomous system index 

20 and an autonomous system path, wherein the autonomous 

21 system index is a key_^ 

22 wherein the first and second data structures may 

23 be used for generating traffic information for analysis . 

1 Claim 36 (original) : The data forwarding device of claim 

2 35 further comprising: 

3 e) a sampler for generating samples based on accepted 

4 addressed data; 

5 f) means for determining path-centric information 

6 based on (i) the samples generated by the sampler, 

7 (ii) the first data structure, and (iii) the second 

8 data structure; and 

9 g) means for adjusting a traffic metric of a traffic 

10 parameter based on the determined path-centric 

11 information. 

1 Claim 37 (currently amended) : A machine-readable medium 

2 having stored thereon: 

3 a) a first data structure including items of a first 

4 type, each of the items of the first type including an 

5 autonomous system index and an internet protocol 
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6 prefix, wherein the internet protocol prefix is a key; 

7 and 

8 b) a second data structure including items of a 

9 second type, each of the items of the second type 

10 including an autonomous system index and an autonomous 

11 system path, wherein the autonomous system index is a 

12 key^ 

13 wherein the first and second data structures may 

14 be used for generating traffic information for analysis . 

1 Claim 3 8 (original) : The machine-readable medium of claim 

2 37 wherein the first and second data structures are tries. 

1 Claim 39 (original) : The machine-readable medium of claim 

2 37 wherein the first data structure is a Radix trie. 

1 Claim 40 (original) : The machine-readable medium of claim 

2 37 further comprising: 

3 c) network information derived from routing 

4 information. 
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